External Secrets Operator

The External Secrets Operator provides an easy synchronization of external secrets providers to native Kubernetes Secret resources.

It supports an extensive list of secrets providers like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager and Azure Key Vault.

We recommend to avoid tight coupling with cloud-specific secret managers and use open-source tools like OpenBao instead.

The External Secrets Operator's provider documentation explains in detail how to configure synchronization with all supported secret providers including all the provider-specific details.

Architecture

The operator holds no credentials of its own. For every ExternalSecret, it reads whichever SecretStore it points at and performs that store's authentication flow fresh, on every sync. Nothing stays connected "at rest".

When OpenBao is the backend, that flow looks like this:

The operator's own ServiceAccount can mint a token for any tenant's ServiceAccount, but each SecretStore only ever requests one for its own, and OpenBao only trusts that identity for that tenant's role and policy. See OpenBao's architecture for how that role/policy scoping is enforced on the other end.